openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external CLI tool outputs and local project files to drive implementation behavior, creating a potential surface for instructions hidden within data to influence the agent.
- Ingestion points: The skill reads JSON output from
openspec statusandopenspec instructions apply, and parses the contents of files identified in thecontextFileslist. - Boundary markers: There are no explicit instructions provided to the agent to treat external file or CLI content as untrusted or to ignore instructions embedded within those artifacts.
- Capability inventory: The skill has the capability to execute the
openspecCLI, read local files, and write modifications to the filesystem. - Sanitization: There is no evidence of input validation or sanitization for the data retrieved from the CLI tool or the context files before the agent processes them.
Audit Metadata